Critical severity · published Aug 16, 2021
CVE-2021-22931
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name…
9.8
CVSS
22%
EPSS
No
On KEV
Description
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)22.0% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
GR
Graalvm · Oracle
20.3.3; 21.2.0 · source: NVD
MC
Mysql Cluster · Oracle
through 8.0.26 · source: NVD
NA
Nextgen Api · Netapp
All versions, or not specified · source: NVD
NO
Node.js · Nodejs
12.0.0 through 12.12.0; 12.13.0 before 12.22.5; 14.0.0 through 14.14.0; 14.15.0 before 14.17.5; 16.0.0 before 16.6.2 · source: NVD
OI
Oncommand Insight · Netapp
All versions, or not specified · source: NVD
OW
Oncommand Workflow Automation · Netapp
All versions, or not specified · source: NVD
PE
Peoplesoft Enterprise Peopletools · Oracle
8.57; 8.58; 8.59 · source: NVD
SI
Sinec Infrastructure Network Services · Siemens
before 1.0.1.1 · source: NVD
SN
Snapcenter · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22931
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22931
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Exploit
https://hackerone.com/reports/1178337
Patch
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
security.gentoo.org
https://security.gentoo.org/glsa/202401-02
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210923-0001/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20211022-0003/
More from Active IQ Unified Manager
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
8.8
CVE-2023-41993
Apple Multiple Products WebKit Code Execution Vulnerability
8.8
CVE-2023-4863
Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
8.1
CVE-2018-11776
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like…
8.1
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g